CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 6.5. Exploitation may require the attacker to be authenticated.
CVE
CVE-2026-31846
Severity
MEDIUM
CVSS
6.5
EPSS
0.25%
Original NVD Description
Missing authentication in the /goform/ate endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows an adjacent unauthenticated attacker to retrieve sensitive device information, including the administrator password. The endpoint returns a raw response containing parameters such as Login_PW, which is Base64-encoded. An attacker can decode this value to obtain valid administrative credentials and authenticate to the device.